Exam Questions Answers Braindumps 200-201 Exam Dumps PDF Questions
Download Free Cisco 200-201 Real Exam Questions
Cisco 200-201 exam is a certification test that focuses on the fundamental concepts and skills needed to operate and secure a network. 200-201 exam is designed to test the knowledge of professionals who are interested in pursuing a career in cybersecurity operations. 200-201 exam is a great way to validate your skills in network security and show your potential employers that you have what it takes to keep their networks secure.
NEW QUESTION # 29
Refer to the exhibit.
Which event is occurring?
- A. A binary named "submit" is running on VM cuckoo1.
- B. A URL is being evaluated to see if it has a malicious binary
- C. A binary is being submitted to run on VM cuckoo1
- D. A binary on VM cuckoo1 is being submitted for evaluation
Answer: C
Explanation:
Explanation
https://cuckoo.readthedocs.io/en/latest/usage/submit/
NEW QUESTION # 30
Refer to the exhibit.
An engineer received an event log file to review. Which technology generated the log?
- A. IDS/IPS
- B. firewall
- C. proxy
- D. NetFlow
Answer: B
NEW QUESTION # 31
An engineer must compare NIST vs ISO frameworks The engineer deeded to compare as readable documentation and also to watch a comparison video review. Using Windows 10 OS. the engineer started a browser and searched for a NIST document and then opened a new tab in the same browser and searched for an ISO document for comparison The engineer tried to watch the video, but there 'was an audio problem with OS so the engineer had to troubleshoot it At first the engineer started CMD and looked fee a driver path then locked for a corresponding registry in the registry editor The engineer enabled "Audiosrv" in task manager and put it on auto start and the problem was solved Which two components of the OS did the engineer touch? (Choose two)
- A. service
- B. process and thread
- C. permissions
- D. MBR
- E. PowerShell logs
Answer: A,B
Explanation:
The engineer engaged with the service component by enabling "Audiosrv," which is the Windows Audio Service responsible for managing audio for Windows-based programs. By setting it to auto-start, the engineer ensured that the service would run automatically upon system startup. Additionally, the engineer interacted with process and thread management by using the Task Manager to modify the behavior of the "Audiosrv" service.
The information is based on standard operating procedures for troubleshooting audio issues in Windows OS, which involves services and processes management.
NEW QUESTION # 32
Which process represents the application-level allow list?
- A. allowing specific format files and deny executable files
- B. allowing everything and denying specific executable files
- C. allowing specific files and deny everything else
- D. allowing everything and denying specific applications protocols
Answer: C
Explanation:
Application-level allow list refers to the practice of specifying an index of approved applications that are permitted to be executed in a system environment or network, which means only specific files are allowed while everything else is denied by default, enhancing security.
NEW QUESTION # 33
An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, "File: Clean." Which regex must the analyst import?
- A. File: Clean
- B. File: Clean (.*)
- C. ^File: Clean$
- D. ^Parent File Clean$
Answer: A
Explanation:
A regular expression (regex) is a sequence of characters that defines a search pattern for text. A regex can be used to extract custom properties from log messages or events in a SIEM platform. In this case, the regex that matches the phrase "File: Clean" exactly is ^File: Clean$. The ^ symbol indicates the beginning of the line and the $ symbol indicates the end of the line. The regex ensures that no other characters are before or after the phrase. References:
* Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) - Cisco, Module 5: Security Policies and Procedures, Lesson 5.3: Data and Event Analysis
* 200-201 CBROPS - Cisco, Exam Topics, 5.0 Security Policies and Procedures, 5.3 Analyze data as part of security monitoring activities
* Cisco Certified CyberOps Associate Overview - Cisco Learning Network, Videos, 5.3 Analyze data as part of security monitoring activities
NEW QUESTION # 34
The target web application server is running as the root user and is vulnerable to command injection. Which result of a successful attack is true?
- A. privilege escalation
- B. buffer overflow
- C. cross-site scripting request forgery
- D. cross-site scripting
Answer: C
NEW QUESTION # 35
Refer to the exhibit.
Drag and drop the element name from the left onto the correct piece of the PCAP file on the right.
Answer:
Explanation:
NEW QUESTION # 36
An intruder attempted malicious activity and exchanged emails with a user and received corporate information, including email distribution lists. The intruder asked the user to engage with a link in an email. When the fink launched, it infected machines and the intruder was able to access the corporate network.
Which testing method did the intruder use?
- A. eavesdropping
- B. piggybacking
- C. social engineering
- D. tailgating
Answer: C
Explanation:
Section: Security Monitoring
NEW QUESTION # 37
Refer to the exhibit.
An engineer is analyzing this Cuckoo Sandbox report for a PDF file that has been downloaded from an email.
What is the state of this file?
- A. The file has an embedded non-Windows executable but no suspicious features are identified.
- B. The file was matched by PEiD threat signatures but no suspicious features are identified since the signature list is up to date.
- C. The file has an embedded Windows 32 executable and the Yara field lists suspicious features for further analysis.
- D. The file has an embedded executable and was matched by PEiD threat signatures for further analysis.
Answer: C
NEW QUESTION # 38
How does agentless monitoring differ from agent-based monitoring?
- A. Agent-based monitoring is less intrusive in gathering log data, while agentless requires open ports to fetch the logs
- B. Agentless can access the data via API. While agent-base uses a less efficient method and accesses log data through WMI.
- C. Agent-based monitoring has a lower initial cost for deployment, while agentless monitoring requires resource-intensive deployment.
- D. Agent-based has a possibility to locally filter and transmit only valuable data, while agentless has much higher network utilization
Answer: D
Explanation:
Agent-based monitoring: With agent-based monitoring, software agents are installed on the monitored systems or devices. These agents collect data locally, perform filtering or preprocessing of the data, and then transmit the relevant or valuable information to the monitoring system. Agent-based monitoring allows for local processing and filtering, which can reduce network utilization by only transmitting essential data. Agentless monitoring: Agentless monitoring, on the other hand, does not require software agents to be installed on the monitored systems or devices. Instead, it relies on leveraging existing protocols and interfaces, such as APIs (Application Programming Interfaces) or SNMP (Simple Network Management Protocol), to remotely access and retrieve monitoring data from the target systems. Agentless monitoring generally involves higher network utilization as the monitoring system needs to gather data from remote systems over the network.
NEW QUESTION # 39
An analyst discovers that a legitimate security alert has been dismissed. Which signature caused this impact on network traffic?
- A. false negative
- B. true negative
- C. true positive
- D. false positive
Answer: A
Explanation:
A false negative occurs when an intrusion detection system (IDS) fails to detect and report actual malicious activity. This means that a legitimate security alert has been dismissed or overlooked, allowing potentially harmful traffic to pass through the network undetected. The impact of false negatives can be significant as they represent missed opportunities to stop or mitigate security threats1.
References := Cisco documentation on security systems, such as IPS (Intrusion Prevention System), discusses the importance of accurately detecting malicious activity and the risks associated with false negatives, which include the failure to trigger alerts for actual attacks1.
NEW QUESTION # 40
Refer to the exhibit.
What is the potential threat identified in this Stealthwatch dashboard?
- A. A policy violation is active for host 10.10.101.24.
- B. A host on the network is sending a DDoS attack to another inside host.
- C. There are three active data exfiltration alerts.
- D. A policy violation is active for host 10.201.3.149.
Answer: D
Explanation:
The Stealthwatch dashboard indicates that there is an active policy violation associated with host
10.201.3.149. Stealthwatch is a security analytics tool that uses network telemetry to detect and respond to threats. In this case, the dashboard has flagged a policy violation, which means that activity from this host has been detected that goes against the defined security policies, potentially indicating a security threat or unauthorized access.
References := Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) training material, which includes information on how to use tools like Stealthwatch to monitor network traffic and identify potential security threats1.
NEW QUESTION # 41
Which information must an organization use to understand the threats currently targeting the organization?
- A. threat intelligence
- B. risk scores
- C. vulnerability exposure
- D. vendor suggestions
Answer: A
Explanation:
Threat intelligence is crucial for organizations to understand the threats they are currently facing. It involves collecting, evaluating, and disseminating information about current or potential attacks that could affect an organization. This intelligence can help organizations prioritize their security measures based on the likelihood and potential impact of different threats. By using threat intelligence, organizations can be more proactive in their defense strategies and respond more effectively to cyber threats.
The Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) course emphasizes the importance of threat intelligence in monitoring security incidents and responding to them
NEW QUESTION # 42
Which two measures are used by the defense-m-depth strategy? (Choose two)
- A. Reduce the load on network devices.
- B. Bridge the single connection into multiple.
- C. Implement the patch management process
- D. Divide the network into parts
- E. Split packets into pieces.
Answer: C,D
Explanation:
The defense-in-depth strategy is a layered approach to security that includes multiple defensive measures to protect against threats. Dividing the network into parts (B) helps isolate potential breaches, making it harder for an attacker to move laterally across the network. Implementing the patch management process (E) ensures that systems are up-to-date with the latest security patches, reducing vulnerabilities that attackers could exploit.
References: Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) course
NEW QUESTION # 43
How does an attack surface differ from an attack vector?
- A. An attack surface mitigates external vulnerabilities, and an attack vector identifies mitigation techniques and possible workarounds.
- B. An attack vector recognizes the potential outcomes of an attack, and the attack surface is choosing a method of an attack.
- C. An attack surface identifies vulnerable parts for an attack, and an attack vector specifies which attacks are feasible to those parts.
- D. An attack vector matches components that can be exploited, and an attack surface classifies the potential path for exploitation
Answer: C
NEW QUESTION # 44
......
Latest Cisco 200-201 Real Exam Dumps PDF: https://www.preppdf.com/Cisco/200-201-prepaway-exam-dumps.html
200-201 Exam Dumps, 200-201 Practice Test Questions: https://drive.google.com/open?id=12UTXQBIsYwi1rQ4S1TdsJnazhZ-L3H8l